Microsoft Windows
CVE-2026-96951: command injection in Windows Shell, exploited.
A command injection flaw in Windows Shell lets an unauthorised attacker bypass a security feature over a network. Microsoft fixed it in the October 2026 security updates and CISA lists it as exploited.
Exploitation
- Exploitation
- Exploited in the wild
- CISA KEV
- Listed 13 Oct 2026
- Federal due date 16 Oct 2026; catalogue read 31 Oct 2026
- EPSS
- 9.8% in 30 days
- Percentile 96%, scored 29 Oct 2026
- 8.8High, (CVSS 3.1)Scored by NVD
- 9.8%EPSS, chance of exploitation in 30 daysPercentile 96%; scored 29 Oct 2026
- 13 OctPublished by NVD13 Oct 2026; record read 29 Oct 2026
Versions
Affected and fixed.
.
| Affected | Fixed in |
|---|---|
| Windows (Windows Shell) | October 2026 Windows and .NET security updates |
What to do now
Deploy the October 2026 Windows updates now. The release notes for the three CVEs we advised on sit in our advisory.
How to check exposure
Exposure is a Windows build below the October 2026 update for its branch. The NVD configuration names the fixed builds for each Windows 10 and Windows 11 release, and the Microsoft Security Response Center entry for CVE-2026-96951, opens in a new tab lists the update for each product.
On a managed fleet the update compliance report in the device management console is the check; on an unmanaged machine, the installed updates list. A device that has not restarted since the update installed is not yet fixed.
Who this reaches in Australia
Every Windows laptop and server in an Australian organisation is in scope, which is why the flaw is on this list: it is the exploited vulnerability of the month with the widest footprint. Our advisory reports the feature bypassed is Mark of the Web, the label that makes Windows warn before it opens a downloaded file.
Under the Essential Eight the fix is patch operating systems. The model gives workstations one month at Maturity Levels 1 and 2 and pulls exploited flaws to 48 hours at Level 3; user application hardening and macro settings are the strategies that limit what a file opened without the warning can do.
Timeline
Disclosed, published, listed, advised.
- : Published by NVD
- : Added to the CISA Known Exploited Vulnerabilities Catalog
- : CISA due date for US federal agencies
- : NVD record last modified
Questions, answered.
Is CVE-2026-96951 exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities Catalog on 13 October 2026, Patch Tuesday.
Which update fixes it?
The October 2026 Windows security update for each supported Windows 10 and Windows 11 release, and the matching Windows Server update. The NVD configuration lists the fixed build for every branch.
What does the security feature bypass mean in practice?
Our advisory reports the feature is Mark of the Web. A file that arrives without the label opens without the warning Windows would otherwise show, which turns a downloaded document into a quieter first step for an attacker.
Provenance
Sources, and when they were read.
Every source was read 31 Oct 2026.
- 1NVD, CVE-2026-96951NIST. US Government work, public domain.
- 2CISA, Known Exploited Vulnerabilities CatalogUS Government work, public domain.
- 3FIRST, EPSS score for CVE-2026-96951EPSS terms of use.
- 4Black Shard, Essential Eight assessment
- 5Black Shard, Microsoft October 2026 Patch Tuesday: exploited Windows Shell flaw and two public zero-days
- 6Vendor reference for CVE-2026-96951: msrc.microsoft.commicrosoft.com. terms of use.